feat: allow editing pending documents (#1346)

## Description

Adds the ability for the document owner to edit recipients and their
fields after the document has been sent.

A recipient can only be updated or deleted if:
- The recipient has not inserted any fields
- Has not completed the document

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

## Release Notes

- **New Features**
- Added new localization messages to clarify user actions regarding
document signing.
  - Enhanced French translations for improved user interaction.

- **Improvements**
- Updated localization strings in German and English for clearer
feedback on signer and recipient statuses.
- Improved overall structure of localization files for better
maintainability.

- **Dependency Updates**
- Upgraded `next-axiom` and `remeda` libraries to their latest versions,
potentially enhancing performance and stability.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Mythie <me@lucasjamessmith.me>

packages/lib/server-only/recipient/set-recipients-for-document.ts

@@ -1,4 +1,9 @@
+import { createElement } from 'react';
+
 import { isUserEnterprise } from '@documenso/ee/server-only/util/is-document-enterprise';
+import { mailer } from '@documenso/email/mailer';
+import { render } from '@documenso/email/render';
+import RecipientRemovedFromDocumentTemplate from '@documenso/email/templates/recipient-removed-from-document';
 import { DOCUMENT_AUDIT_LOG_TYPE } from '@documenso/lib/types/document-audit-logs';
 import {
   type TRecipientActionAuthTypes,
@@ -16,20 +21,16 @@ import type { Recipient } from '@documenso/prisma/client';
 import { RecipientRole } from '@documenso/prisma/client';
 import { SendStatus, SigningStatus } from '@documenso/prisma/client';
 
+import { NEXT_PUBLIC_WEBAPP_URL } from '../../constants/app';
+import { FROM_ADDRESS, FROM_NAME } from '../../constants/email';
 import { AppError, AppErrorCode } from '../../errors/app-error';
+import { canRecipientBeModified } from '../../utils/recipients';
 
 export interface SetRecipientsForDocumentOptions {
   userId: number;
   teamId?: number;
   documentId: number;
-  recipients: {
-    id?: number | null;
-    email: string;
-    name: string;
-    role: RecipientRole;
-    signingOrder?: number | null;
-    actionAuth?: TRecipientActionAuthTypes | null;
-  }[];
+  recipients: RecipientData[];
   requestMetadata?: RequestMetadata;
 }
 
@@ -59,6 +60,9 @@ export const setRecipientsForDocument = async ({
             teamId: null,
           }),
     },
+    include: {
+      Field: true,
+    },
   });
 
   const user = await prisma.user.findFirstOrThrow({
@@ -116,25 +120,28 @@ export const setRecipientsForDocument = async ({
       ),
   );
 
-  const linkedRecipients = normalizedRecipients
-    .map((recipient) => {
-      const existing = existingRecipients.find(
-        (existingRecipient) =>
-          existingRecipient.id === recipient.id || existingRecipient.email === recipient.email,
-      );
+  const linkedRecipients = normalizedRecipients.map((recipient) => {
+    const existing = existingRecipients.find(
+      (existingRecipient) =>
+        existingRecipient.id === recipient.id || existingRecipient.email === recipient.email,
+    );
 
-      return {
-        ...recipient,
-        _persisted: existing,
-      };
-    })
-    .filter((recipient) => {
-      return (
-        recipient._persisted?.role === RecipientRole.CC ||
-        (recipient._persisted?.sendStatus !== SendStatus.SENT &&
-          recipient._persisted?.signingStatus !== SigningStatus.SIGNED)
+    if (
+      existing &&
+      hasRecipientBeenChanged(existing, recipient) &&
+      !canRecipientBeModified(existing, document.Field)
+    ) {
+      throw new AppError(
+        AppErrorCode.INVALID_REQUEST,
+        'Cannot modify a recipient who has already interacted with the document',
       );
-    });
+    }
+
+    return {
+      ...recipient,
+      _persisted: existing,
+    };
+  });
 
   const persistedRecipients = await prisma.$transaction(async (tx) => {
     return await Promise.all(
@@ -268,6 +275,37 @@ export const setRecipientsForDocument = async ({
         ),
       });
     });
+
+    // Send emails to deleted recipients.
+    await Promise.all(
+      removedRecipients.map(async (recipient) => {
+        if (recipient.sendStatus !== SendStatus.SENT) {
+          return;
+        }
+
+        const assetBaseUrl = NEXT_PUBLIC_WEBAPP_URL() || 'http://localhost:3000';
+
+        const template = createElement(RecipientRemovedFromDocumentTemplate, {
+          documentName: document.title,
+          inviterName: user.name || undefined,
+          assetBaseUrl,
+        });
+
+        await mailer.sendMail({
+          to: {
+            address: recipient.email,
+            name: recipient.name,
+          },
+          from: {
+            name: FROM_NAME,
+            address: FROM_ADDRESS,
+          },
+          subject: 'You have been removed from a document',
+          html: render(template),
+          text: render(template, { plainText: true }),
+        });
+      }),
+    );
   }
 
   // Filter out recipients that have been removed or have been updated.
@@ -284,3 +322,27 @@ export const setRecipientsForDocument = async ({
 
   return [...filteredRecipients, ...persistedRecipients];
 };
+
+/**
+ * If you change this you MUST update the `hasRecipientBeenChanged` function.
+ */
+type RecipientData = {
+  id?: number | null;
+  email: string;
+  name: string;
+  role: RecipientRole;
+  signingOrder?: number | null;
+  actionAuth?: TRecipientActionAuthTypes | null;
+};
+
+const hasRecipientBeenChanged = (recipient: Recipient, newRecipientData: RecipientData) => {
+  const authOptions = ZRecipientAuthOptionsSchema.parse(recipient.authOptions);
+
+  return (
+    recipient.email !== newRecipientData.email ||
+    recipient.name !== newRecipientData.name ||
+    recipient.role !== newRecipientData.role ||
+    recipient.signingOrder !== newRecipientData.signingOrder ||
+    authOptions.actionAuth !== newRecipientData.actionAuth
+  );
+};